#!/usr/bin/python
# -*- coding:utf-8 -*-
import os
import re
import time
import math


def check_hex(img_path, p):
    with open(img_path, 'rb') as f:
        content = f.read()
        f.close()
    # print(content)#将直接转换为十六进制
    if p.search(content.hex()):
        return True
    return False


def main(path):
    # <?php ?>|eval|fputs|fwrite
    p1 = re.compile(
        '(3c3f706870.*?3f3e)|(6576616c)|(6670757473)|(667772697465)')
    scan_start = time.time()
    total_files = 0
    total_taged = []
    for parent, dirname, filenames in os.walk(path):
        for file in filenames:
            img_path = parent+os.path.sep+file
            #v这里只针对图片类型进行扫描修改
            if re.search("\.(jpg|png|gif)$",file):
                total_files += 1
                if check_hex(img_path, p1):
                    #print()
                    total_taged.append(img_path)
    scan_end = time.time()

    print('扫描完成！总用时:%.2f秒。\r\n总共扫描文件数: %d，中标文件数: %d。' %
          ((scan_end-scan_start), total_files, len(total_taged)))
    for tag in total_taged:
    	print(tag)
    print('END')


if __name__ == '__main__':
    imgpath = r"M:\data_img\hrimg"
    main(imgpath)
#此文件扫描目录中有挂马的图片
# 扫描完成！总用时:97.24秒。
# 总共扫描文件数: 1320，中标文件数: 28。
